You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ContReg1. You enable content trust for…

To create a trusted image in an Azure Container Registry (ACR) with content trust enabled, a user must perform two distinct actions: pushing the image to the registry and then signing it. The principle of least privilege dictates assigning roles that grant only the necessary permissions for these specific actions.

The AcrPush role grants the Microsoft.ContainerRegistry/registries/push/write permission, which is required to upload an image to the registry. The AcrImageSigner role grants the Microsoft.ContainerRegistry/registries/sign/write permission, which is specifically required to sign images for content trust. Assigning both roles provides User1 with the exact permissions needed without granting excessive privileges.

A. AcrQuarantineWriter: This role is for pushing images to a quarantine repository, a separate feature from content trust, and does not grant signing permissions.

B. Contributor: This is a management-plane role that grants broad permissions to manage the ACR instance itself, violating the principle of least privilege. It does not inherently include data-plane permissions for signing.

C. AcrQuarantineReader: This role only allows pulling images from a quarantine repository and is irrelevant to creating or signing new images.

1. Microsoft Learn

Content trust in Azure Container Registry. This document explicitly states the required roles. In the "Push a trusted image" section

it says

"To push a trusted image tag to your container registry

you must have permissions to both push the image and sign images. In addition to the AcrPush role (or equivalent) to push images

you need to assign the AcrImageSigner role to the user."

Source: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-content-trust#push-a-trusted-image

2. Microsoft Learn

Azure Container Registry roles and permissions. This page details the specific permissions for each built-in role.

AcrPush: "push an image

or push another supported artifact such as a Helm chart

to the registry." Includes action: Microsoft.ContainerRegistry/registries/push/write.

AcrImageSigner: "sign images

typically assigned to an automated process that uses a service principal." Includes action: Microsoft.ContainerRegistry/registries/sign/write.

Source: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli#roles